node-forge is vulnerable to ASN.1 OID Integer Truncation

Description

MITRE-Formatted CVE Description An Integer Overflow (CWE-190) vulnerability in node-forge versions 1.3.1 and below enables remote, unauthenticated attackers to craft ASN.1 structures containing OIDs with oversized arcs.

Recommendation

Update the node-forge package to the latest compatible version. Followings are version details:

• Affected version(s): < 1.3.2
• Patched version(s): 1.3.2

References

• GHSA-65ch-62r8-g69g
• CVE-2025-66030
• CWE-190
• CAPEC-310
• OWASP 2021-A6

Related Issues

• node-forge has ASN.1 Unbounded Recursion - CVE-2025-66031
• node-forge has an Interpretation Conflict vulnerability via its ASN.1 Validator Desynchronization - CVE-2025-12816
• SvelteKit is vulnerable to denial of service and possible SSRF when using prerendering - @sveltejs/adapter-node - CVE-2025-67647
• Open Redirect in node-forge - CVE-2022-0122

You might also like:

How to Secure your NodeJs Express Javascript Application - part 1

How to Secure your NodeJs Express Javascript Application - part 2

10 Secure Coding Best Practices to Follow in Every Project

Tags:

npm

node-forge